CN104660563A - Method, equipment and system for processing active detection response - Google Patents

Abstract

The invention discloses a method, equipment and a system for processing an active detection response. The method comprises the following steps: current equipment receives an active detection request from remote equipment, obtains an IP (internet protocol) address of the remote equipment and obtains the positive logic active detection response corresponding to the active detection request; the current equipment judges whether the IP address is within an IP address credible region range or not; if the IP address is within the IP address credible region range, the current equipment sends the positive logic active detection response to the remote equipment; if the IP address is not within the IP address credible region range, the current equipment performs negative logic treatment on the positive logic active detection response, obtains a negative logic active detection response and sends the negative logic active detection response to the remote equipment. According to the embodiment of the invention, an attacker can be prevented from mining key network data from the active detection response, so that an attack behavior cannot be made, the network security is improved, and insecurity, information leakage and the like caused by positive logic are avoided.

Description

The processing method that a kind of active probe responds, equipment and system

Technical field

The present invention relates to the communication technology and security technology area, especially relate to the processing method of a kind of active probe response, equipment and system.

Background technology

Along with developing rapidly of computer and network technologies, network size constantly expands, and bandwidth constantly increases, and Network kind is more and more diversified, and the various equipment in network become varied.If assailant will launch a offensive, then assailant needs acquisition and the collection of in advance target of attack being carried out to information, first step of namely attacking is acquisition and the collection of information, thus the information such as the system information of various equipment in master goal network, network configuration, the service that provides, think that the expansion of follow-on attack is prepared.In order to obtain the information such as the system information of various equipment in network, network configuration, the service that provides, current attack person generally adopts the mode of active probe, and carries out analysis by the information responded active probe and obtain.

Active probe refers to that remote equipment sends active probe request on network, the process that local device responds containing the active probe of result of detection information for active probe request feedback packet.Such as, the ICMP(Internet Control Message Protocol sent, Internet Control Message Protocol) ask or UDP(UserDatagram Protocol, User Datagram Protocol) to ask to belong to active probe request, ICMP response or the UDP response of transmission belong to active probe response.Based on active probe response, then assailant can obtain the information such as the system information of local device, network configuration, the service that provides easily.

In prior art, active probe response all adopts forward logical course to feed back, namely the results expression fed back be direct legitimate reading, assailant can obtain the active probe response of forward logic by active probe process, and then excavates a lot of crucial network data by active probe response.

Therefore, in prior art, there is the problem such as insecurity, information leakage in the feedback of active probe response, is very easy to the enforcement of the follow-up attack of assailant, there is serious potential safety hazard.

Summary of the invention

Processing method, equipment and system that the embodiment of the present invention provides a kind of active probe to respond, to avoid assailant to excavate crucial network data from active probe response, improve internet security.

In order to achieve the above object, the processing method that the embodiment of the present invention provides a kind of active probe to respond, the method comprises the following steps: local device is after receiving the active probe request from remote equipment, obtain the IP address of described remote equipment, and obtain the active probe response of forward logic corresponding to described active probe request; Described local device judges whether described IP address is positioned at IP address inter-trust domain scope; If so, the response of the active probe of described forward logic is sent to remote equipment by described local device; If not, negative logic process is carried out in the active probe response of described local device to described forward logic, obtains the active probe response of negative logic, the response of the active probe of described negative logic is sent to remote equipment.

Negative logic process is carried out in the active probe response of described local device to forward logic, obtains the active probe response of negative logic, specifically comprises: respond as S in the active probe of forward logic _i, and S _iduring ∈ S, negative logic process is carried out in the active probe response of described local device to forward logic, and the active probe response of the negative logic obtained is specially in S except S _ioutside random free position; S={S ₁, S ₂, S ₃..., S _n, and described S is the real responsive state of active probe response correspondence, and i ∈ 1,2,3 ..., n}.

The treatment facility that the embodiment of the present invention provides a kind of active probe to respond, this equipment specifically comprises: acquisition module, for after receiving the active probe request from remote equipment, obtain the IP address of remote equipment, and obtain the active probe response of forward logic corresponding to active probe request; Judge module, for judging whether IP address is positioned at IP address inter-trust domain scope; Processing module, during for being no when judged result, carrying out negative logic process to the active probe response of forward logic, obtaining the active probe response of negative logic; Sending module, during for being no when judged result, sends to remote equipment by the response of the active probe of negative logic; When judged result is for being, the response of the active probe of forward logic is sent to remote equipment.

Described processing module is S specifically for the active probe response in described forward logic _i, and S _iduring ∈ S, carry out negative logic process to the active probe response of described forward logic, the active probe response of the negative logic obtained is specially: except S in S _ioutside random free position; Wherein, S={S ₁, S ₂, S ₃..., S _n, and described S is the real responsive state of active probe response correspondence, and i ∈ 1,2,3 ..., n}.

The processing method that the embodiment of the present invention provides a kind of active probe to respond, the method comprises the following steps:

Local device is after receiving the active probe request from remote equipment, obtain the IP address of described remote equipment, and obtain the active probe response of forward logic corresponding to described active probe request, and the active probe response of described IP address and described forward logic is sent to credible determination module;

Described credible determination module judges whether described IP address is positioned at IP address inter-trust domain scope; If so, the active probe response of the believable information in described IP address and described forward logic is sent to described local device by described credible determination module, by described local device, the response of the active probe of described forward logic is sent to described remote equipment; If not, the active probe response of the incredible information in described IP address and described forward logic is sent to negative logic system NLS processing module by described credible determination module;

Negative logic process is carried out in the active probe response of described NLS processing module to described forward logic, obtain the active probe response of negative logic, and the response of the active probe of described negative logic is sent to described local device, by described local device, the active probe of described negative logic is responded described in transmission to remote equipment.

Negative logic process is carried out in the active probe response of described NLS processing module to forward logic, obtains the active probe response of negative logic, comprising: respond as S in the active probe of forward logic _i, and S _iduring ∈ S, negative logic process is carried out in the active probe response of NLS processing module to forward logic, and the active probe response of the negative logic obtained is specially in S except S _ioutside random free position; S={S ₁, S ₂, S ₃..., S _n, and described S is the real responsive state of active probe response correspondence, and i ∈ 1,2,3 ..., n}.

Negative logic process is carried out in the active probe response of described NLS processing module to described forward logic, obtain the active probe response of negative logic, comprise: NLS processing module determines the active probe response being input as forward logic of this NLS processing module, after negative logic process is carried out to the active probe response of forward logic, the output obtained is other active probe response outside the active probe response of forward logic, and other active probe outside the response of the active probe of forward logic responds as the active probe of negative logic responds.

The treatment system that the embodiment of the present invention provides a kind of active probe to respond, this system specifically comprises:

Local device, for after receiving the active probe request from remote equipment, obtain the IP address of described remote equipment, and obtain the active probe response of forward logic corresponding to described active probe request, and the active probe response of described IP address and described forward logic is sent to credible determination module;

Credible determination module, for judging whether described IP address is positioned at IP address inter-trust domain scope; If so, then the active probe response of the believable information in described IP address and described forward logic is sent to described local device, by described local device, the response of the active probe of described forward logic is sent to described remote equipment; If not, then the active probe response of the incredible information in described IP address and described forward logic is sent to negative logic system NLS processing module;

NLS processing module, for carrying out negative logic process to the active probe response of described forward logic, obtain the active probe response of negative logic, and the response of the active probe of described negative logic is sent to described local device, by described local device, the active probe of described negative logic is responded described in transmission to remote equipment.

Described NLS processing module is S specifically for the active probe response in forward logic _i, and S _iduring ∈ S, carry out negative logic process to the active probe response of described forward logic, the active probe response of the negative logic obtained is specially: except S in S _ioutside random free position; Wherein, S={S ₁, S ₂, S ₃..., S _n, and described S is the real responsive state of active probe response correspondence, and i ∈ 1,2,3 ..., n}.

Described NLS processing module, specifically for determining the active probe response being input as described forward logic of this NLS processing module, after negative logic process is carried out to the active probe response of described forward logic, the output obtained is other active probe response outside the active probe response of described forward logic, and other active probe outside the response of the active probe of described forward logic responds as the active probe of negative logic responds.

Compared with prior art, the embodiment of the present invention at least has the following advantages: in the embodiment of the present invention, by carrying out negative logic process to the active probe response of forward logic, obtain the active probe response of negative logic, and the response of the active probe of negative logic is sent to remote equipment, thus avoid assailant to excavate crucial network data from active probe response, and then cannot offensive attack behavior, improve internet security, avoid insecurity, information leakage etc. that forward logic is brought, then avoid potential safety hazard.Aforesaid way has important using value to network security and information security field, can contain and prevent the generation of attack; Safety for the such as new technology such as Internet of Things, car networking is promoted and the safety applications of new business corresponding under new technology, all has very important practical application and market popularization value and meaning.

Accompanying drawing explanation

In order to be illustrated more clearly in technical scheme of the present invention, below the accompanying drawing used required in describing embodiment is briefly described, apparently, accompanying drawing in the following describes is only some embodiments of the present invention, for those of ordinary skill in the art, under the prerequisite not paying creative work, other accompanying drawing can also be obtained according to these accompanying drawings.

Fig. 1 is the process flow figure of a kind of active probe response that the embodiment of the present invention one provides;

Fig. 2 is the process flow figure of a kind of active probe response that the embodiment of the present invention two provides;

Fig. 3 is the schematic diagram in the embodiment of the present invention, active probe response being carried out to negative logic process;

Fig. 4 is the treatment facility structural representation of a kind of active probe response that the embodiment of the present invention three provides;

Fig. 5 is the treatment system structural representation of a kind of active probe response that the embodiment of the present invention four provides.

Embodiment

Below in conjunction with the accompanying drawing in the present invention, be clearly and completely described the technical scheme in the present invention, obviously, described embodiment is only a part of embodiment of the present invention, instead of whole embodiments.Based on the embodiment in the present invention, those of ordinary skill in the art, not making the every other embodiment obtained under creative work prerequisite, belong to the scope of protection of the invention.

Embodiment one

The processing method that the embodiment of the present invention one provides a kind of active probe to respond, by the state that responds active probe according to negative logical thinking NLS(negative logic system) carry out the method for negative logic expression, thus make assailant cannot get the information of effectively attacking and utilizing from the response of obtained active probe, as shown in Figure 1, the processing method of this active probe response at least comprises the following steps:

Step 101, local device, after receiving the active probe request from remote equipment, obtains the IP address of remote equipment, and obtains the active probe response of forward logic corresponding to active probe request.

Wherein, the IP address of this remote equipment can obtain from active probe request, this active probe request is Msg_Request, the active probe response of this forward logic is Msg_Respond_PLS, and the active probe response of the active probe of this forward logic response for obtaining based on existing mode.

Step 102, local device judges whether this IP address (i.e. the IP address of remote equipment) is positioned at IP address inter-trust domain scope; If so, then step 103 is performed; If not, then step 104 is performed.

Wherein, the IP address within the scope of this IP address inter-trust domain is legal IP address.

Step 103, the response of the active probe of forward logic is sent to remote equipment by local device.

Step 104, negative logic process is carried out in the active probe response of local device to forward logic, obtains the active probe response of negative logic, and the response of the active probe of negative logic is sent to remote equipment.

In the embodiment of the present invention, suppose that the true responsive state one that active probe responds has n, be denoted as S ₁, S ₂, S ₃..., S _n, make S={S ₁, S ₂, S ₃..., S _n, then for any one responsive state S _i∈ S, wherein i ∈ 1,2,3 ..., n}, the logical value that the negative logic thinking NLS of active probe response is corresponding is in S, except S _ioutside a random arbitrary state, that is: $\mathrm{NLS}\left(S_i\right)\stackrel{\mathrm{def}}{=}\left\{S_j\right|S_j\∈S,S_j\≠S_i,j\∈\{\mathrm{1,2,3},...,n\}\}.$

Based on this, negative logic process is carried out in the active probe response of local device to forward logic, obtains the active probe response of negative logic, specifically comprises: respond as S in the active probe of forward logic _i, and S _iduring ∈ S, negative logic process is carried out in the active probe response of local device to forward logic, and the active probe response of the negative logic obtained is specially: except S in S _ioutside random free position; Wherein, S={S ₁, S ₂, S ₃..., S _n, and S is the real responsive state of active probe response correspondence, and i ∈ 1,2,3 ..., n}.

In sum, by the technical scheme adopting the embodiment of the present invention to propose, by carrying out negative logic process to the active probe response of forward logic, obtain the active probe response of negative logic, and the response of the active probe of negative logic is sent to remote equipment, thus avoid assailant to excavate crucial network data from active probe response, and then cannot offensive attack behavior, improve internet security, avoid insecurity, information leakage etc. that forward logic is brought, then avoid potential safety hazard.Further, aforesaid way has important using value to network security and information security field, can contain and prevent the generation of attack; Safety for the such as new technology such as Internet of Things, car networking is promoted and the safety applications of new business corresponding under new technology, all has very important practical application and market popularization value and meaning.

Embodiment two

The processing method that the embodiment of the present invention two provides a kind of active probe to respond, by the state that responds active probe according to negative logical thinking NLS(negative logic system) carry out the method for negative logic expression, thus make assailant cannot get the information of effectively attacking and utilizing from the response of obtained active probe, as shown in Figure 2, the processing method of this active probe response at least comprises the following steps:

Step 201, local device is after receiving the active probe request from remote equipment, obtain the IP address of remote equipment, and obtain the active probe response of forward logic corresponding to active probe request, and credible determination module is exported in the active probe response of this IP address and this forward logic.

Wherein, the IP address of this remote equipment can obtain from active probe request, this active probe request is Msg_Request, the active probe response of this forward logic is Msg_Respond_PLS, and the active probe response of the active probe of this forward logic response for obtaining based on existing mode.

Step 202, credible determination module judges whether this IP address (i.e. the IP address of remote equipment) is positioned at IP address inter-trust domain scope; If so, then step 203 is performed; If not, then step 205 is performed.

Wherein, the IP address within the scope of this IP address inter-trust domain is legal IP address.

Step 203, the active probe response of this believable information in IP address and forward logic is sent to local device by credible determination module.Wherein, credible determination module is after the active probe response receiving IP address and forward logic, if know that this IP address is positioned at IP address inter-trust domain scope, then determine that this IP address is credible, and the active probe response of this believable information in IP address (as represented that IP address is credible by credible result of determination YES) and forward logic is sent to local device.

Step 204, the response of the active probe of forward logic is sent to remote equipment by local device.

Step 205, the active probe response of this incredible information in IP address and forward logic is sent to NLS processing module by credible determination module.Wherein, credible determination module is after the active probe response receiving IP address and forward logic, if know that this IP address is not positioned at IP address inter-trust domain scope, then determine that this IP address is insincere, and the active probe response of this incredible information in IP address (as represented that IP address is insincere by credible result of determination NO) and forward logic is sent to NLS processing module.

Step 206, negative logic process is carried out in the active probe response of NLS processing module to forward logic, obtains the active probe response of negative logic, and the response of the active probe of negative logic is sent to local device.

Wherein, the response of the active probe of this negative logic is specially Msg_Respond_NLS, and the response of the active probe of this negative logic is specially and finally needs to send to the active probe of remote equipment to respond.

In the embodiment of the present invention, suppose that the true responsive state one that active probe responds has n, be denoted as S ₁, S ₂, S ₃..., S _n, make S={S ₁, S ₂, S ₃..., S _n, then for any one responsive state S _i∈ S, wherein i ∈ 1,2,3 ..., n}, the logical value that the negative logic thinking NLS of active probe response is corresponding is in S, except S _ioutside a random arbitrary state, that is: $\mathrm{NLS}\left(S_i\right)\stackrel{\mathrm{def}}{=}\left\{S_j\right|S_j\∈S,S_j\≠S_i,j\∈\{\mathrm{1,2,3},...,n\}\}.$

Based on this, negative logic process is carried out in the active probe response of NLS processing module to forward logic, obtains the active probe response of negative logic, comprising: respond as S in the active probe of forward logic _i, and S _iduring ∈ S, negative logic process is carried out in the active probe response of NLS processing module to forward logic, and the active probe response of the negative logic obtained is specially: except S in S _ioutside random free position; S={S ₁, S ₂, S ₃..., S _n, and S is the real responsive state of active probe response correspondence, and i ∈ 1,2,3 ..., n}.

Further, in a kind of specific implementation of the embodiment of the present invention, negative logic process is carried out in the active probe response of NLS processing module to forward logic, to obtain the process of the active probe response of negative logic, specifically include but not limited to: NLS processing module determines the active probe response being input as forward logic of this NLS processing module, after negative logic process is carried out to the active probe response of forward logic, the output obtained is other active probe response outside the active probe response of forward logic, and other active probe outside the response of the active probe of forward logic responds as the active probe of negative logic responds.

Step 207, the response of the active probe of negative logic is sent to remote equipment by local device.

In sum, by the technical scheme adopting the embodiment of the present invention to propose, by carrying out negative logic process to the active probe response of forward logic, obtain the active probe response of negative logic, and the response of the active probe of negative logic is sent to remote equipment, thus avoid assailant to excavate crucial network data from active probe response, and then cannot offensive attack behavior, improve internet security, avoid insecurity, information leakage etc. that forward logic is brought, then avoid potential safety hazard.Further, aforesaid way has important using value to network security and information security field, can contain and prevent the generation of attack; Safety for the such as new technology such as Internet of Things, car networking is promoted and the safety applications of new business corresponding under new technology, all has very important practical application and market popularization value and meaning.

Below in conjunction with schematic diagram active probe response being carried out to negative logic process as shown in Figure 3, the process (i.e. step 104 or step 206) of negative logic process is further detailed.

Entry 101 represents input item, has input value, as S _i, the value of entry 101 outputs to entry 102.Entry 102 represents NLS processing center, includes but not limited to: NLS treatment mechanism and system select with transform, screen, operation method employing etc., the result of entry 102 outputs to entry 103, entry 104, entry 105, entry 106, one in entry 107.Entry 103, entry 104, entry 105, entry 106, entry 107 all represents output item, each time entry 103, entry 104, entry 105, entry 106, all has an entry as when time actual output item, can receive the Output rusults from entry 102 in entry 107, which entry concrete is determined by the Output rusults of entry 102, and such as output valve is S ₂.By said method, then can obtain, under negative logic system NLS, this time S _icorresponding logic value is S ₂.

In embody rule scene, with FTP(File Transfer Protocol, file transfer protocol (FTP)) use of ordering is described for example.Wherein, the response code that FTP is corresponding adopts three bit digital to represent, each response code represents different response message.FTP is altogether to there being 39 kinds of response codes, and concrete response code numbering is respectively: 110,120,125,150,200,202,211,212,213,214,215,220,221,225,226,227,230,250,257,331,332,350,421,425,426,450,451,452,500,501,502,503,504,530,532,550,551,552,553.

User A in application scenarios 1, inter-trust domain carries out FTP access to certain main frame, and the IP address of user A is IP1, and the IP address of main frame is IP_HOST.After user A sends FTP request to this main frame, first this main frame obtains this FTP and asks, IP1 is extracted from this FTP asks, obtain the active probe response of forward logic simultaneously, suppose that the active probe response code of forward logic is that 452(represents that disk storage space is not enough), then IP1 and probe response code 452 are sent to credible determination module by this main frame.Because IP1 is within inter-trust domain, therefore credible result of determination is YES, and result of determination YES and probe response code 452 are sent to this main frame by credible determination module, and probe response code 452 is returned to user A by this main frame.After user A receives probe response code 452, know that the disk storage space of current main frame is not enough.

User B in application scenarios 2, untrusted territory carries out FTP access to certain main frame, and the IP address of user B is IP2, and the IP address of main frame is IP_HOST.After user B sends FTP request to this main frame, first this main frame obtains this FTP and asks, IP2 is extracted from this FTP asks, obtain the active probe response of forward logic simultaneously, suppose that the active probe response code of forward logic is that 452(represents that disk storage space is not enough), then IP2 and probe response code 452 are sent to credible determination module by this main frame.Because IP2 is not within inter-trust domain, therefore credible result of determination is NO, and result of determination NO and probe response code 452 are sent to negative logic system NLS by credible determination module.Negative logic system NLS carries out negative logic process to probe response code 452, the result obtained after NLS process is any one the probe response code in 39 kinds of probe response codes except probe response code 452, is assumed to be probe response code 532(and represents that storage file needs account).Afterwards, probe response code 532 is sent to this main frame by negative logic system NLS, and probe response code 532 is returned to user B by this main frame.After user B receives probe response code 532, think that storage file needs account, and do not know that the disk storage space of current main frame is not enough, thus reduce or prevent user in insincere territory to the acquisition of main frame real information.

Embodiment three

Based on the inventive concept same with said method, additionally provide the treatment facility of a kind of active probe response in the embodiment of the present invention, as shown in Figure 4, this equipment comprises:

Acquisition module 11, for after receiving the active probe request from remote equipment, obtains the IP address of described remote equipment, and obtains the active probe response of forward logic corresponding to described active probe request;

Judge module 12, for judging whether described IP address is positioned at IP address inter-trust domain scope;

Processing module 13, during for being no when judged result, carrying out negative logic process to the active probe response of described forward logic, obtaining the active probe response of negative logic;

Sending module 14, during for being no when judged result, sends to described remote equipment by the response of the active probe of described negative logic; When judged result is for being, the response of the active probe of described forward logic is sent to described remote equipment.

Described processing module 13 is S specifically for the active probe response in described forward logic _i, and S _iduring ∈ S, carry out negative logic process to the active probe response of described forward logic, the active probe response of the negative logic obtained is specially: except S in S _ioutside random free position; Wherein, S={S ₁, S ₂, S ₃..., S _n, and described S is the real responsive state of active probe response correspondence, and i ∈ 1,2,3 ..., n}.

Wherein, the modules of apparatus of the present invention can be integrated in one, and also can be separated deployment.Above-mentioned module can merge into a module, also can split into multiple submodule further.

Embodiment four

Based on the inventive concept same with said method, the treatment system of a kind of active probe response is additionally provided in the embodiment of the present invention, this system specifically comprises: local device, for after receiving the active probe request from remote equipment, obtain the IP address of described remote equipment, and obtain the active probe response of forward logic corresponding to described active probe request, and the active probe response of described IP address and described forward logic is sent to credible determination module; Credible determination module, for judging whether described IP address is positioned at IP address inter-trust domain scope; If so, then the active probe response of the believable information in described IP address and described forward logic is sent to described local device, by described local device, the response of the active probe of described forward logic is sent to described remote equipment; If not, then the active probe response of the incredible information in described IP address and described forward logic is sent to negative logic system NLS processing module; NLS processing module, for carrying out negative logic process to the active probe response of described forward logic, obtain the active probe response of negative logic, and the response of the active probe of described negative logic is sent to described local device, by described local device, the active probe of described negative logic is responded described in transmission to remote equipment.

Described NLS processing module is S specifically for the active probe response in forward logic _i, and S _iduring ∈ S, carry out negative logic process to the active probe response of described forward logic, the active probe response of the negative logic obtained is specially: except S in S _ioutside random free position; Wherein, S={S ₁, S ₂, S ₃..., S _n, and described S is the real responsive state of active probe response correspondence, and i ∈ 1,2,3 ..., n}.

Described NLS processing module, specifically for determining the active probe response being input as described forward logic of this NLS processing module, after negative logic process is carried out to the active probe response of described forward logic, the output obtained is other active probe response outside the active probe response of described forward logic, and other active probe outside the response of the active probe of described forward logic responds as the active probe of negative logic responds.

Below in conjunction with Fig. 5, the treatment system that active probe responds is further detailed.

As shown in Figure 5, assembly 201, assembly 202, assembly 203 all represent the input item of active probe responding system, and namely assembly 201, assembly 202, assembly 203 are active probe request, have input value, as I ₁, I ₂... I _n, the value of assembly 201, assembly 202, assembly 203 is output to local device 211.

The active probe of forward logic for the output of receiving unit 201, assembly 202, assembly 203, and is responded FR by local device 211 ₁, FR ₂..., FR _nand the IP address ip 1 of correspondence, IP2 ..., IPn etc. outputs in credible determination module 221, credible determination module 222, credible determination module 223.

Credible determination module 221, credible determination module 222, credible determination module 223 are for carrying out credible judgement to the IP address of extracting, IP address is judged whether as believable IP address according to the scope of inter-trust domain, if IP address is credible, then credible result of determination is YES; If IP address is insincere, then credible result of determination is NO.Afterwards, credible result of determination is exported simultaneously according to the difference of credible result of determination, outputted in different modules.Wherein, when credible result of determination is YES, by the active probe of forward logic response FR ₁, FR ₂..., FR _noutput in assembly 241, assembly 242, assembly 243.When credible result of determination is NO, by the active probe of forward logic response FR ₁, FR ₂..., FR _noutput in NLS processing module 231, NLS processing module 232, NLS processing module 233.

Active probe response FR corresponding when NLS processing module 231, NLS processing module 232, NLS processing module 233 are for being NO to credible result of determination ₁, FR ₂..., FR _ncarry out negative logic process, thus obtain the active probe response of negative logic, and the response of the active probe of negative logic is exported.Therefore, NLS processing module 231, NLS processing module 232, NLS processing module 233 receive the output of credible determination module, namely receive the active probe response FR of forward logic ₁, FR ₂..., FR _n, and the response of the active probe of negative logic is outputted in assembly 241, assembly 242, assembly 243.

Assembly 241, assembly 242, assembly 243 all represent output item, namely export the probe response result received.By the impact of credible result of determination, its Data Source received is different according to the difference of credible result of determination.When credible result of determination is YES, assembly 241, assembly 242, assembly 243 receive the Output rusults from credible determination module 221, credible determination module 222, credible determination module 223 respectively, i.e. the active probe response FR of forward logic ₁, FR ₂..., FR _nas output valve R ₁, R ₂..., R _n.When credible result of determination is NO, assembly 241, assembly 242, assembly 243 receive the Output rusults from NLS processing module 231, NLS processing module 232, NLS processing module 233 respectively, and the final active probe response results namely after negative logic process is as output valve R ₁, R ₂..., R _n.

Through the above description of the embodiments, those skilled in the art can be well understood to the mode that the present invention can add required general hardware platform by software and realize, and can certainly pass through hardware, but in a lot of situation, the former is better execution mode.Based on such understanding, technical scheme of the present invention can embody with the form of software product the part that prior art contributes in essence in other words, this computer software product is stored in a storage medium, comprising some instructions in order to make a computer equipment (can be personal computer, server, or the network equipment etc.) perform method described in each embodiment of the present invention.

It will be appreciated by those skilled in the art that accompanying drawing is the schematic diagram of a preferred embodiment, the module in accompanying drawing or flow process might not be that enforcement the present invention is necessary.

It will be appreciated by those skilled in the art that the module in the device in embodiment can carry out being distributed in the device of embodiment according to embodiment description, also can carry out respective change and be arranged in the one or more devices being different from the present embodiment.The module of above-described embodiment can merge into a module, also can split into multiple submodule further.

The invention described above embodiment sequence number, just to describing, does not represent the quality of embodiment.

Be only several specific embodiment of the present invention above, but the present invention is not limited thereto, the changes that any person skilled in the art can think of all should fall into protection scope of the present invention.

Claims (10)

1. a processing method for active probe response, it is characterized in that, the method comprises the following steps:

Local device, after receiving the active probe request from remote equipment, obtains the IP address of described remote equipment, and obtains the active probe response of forward logic corresponding to described active probe request;

Described local device judges whether described IP address is positioned at IP address inter-trust domain scope;

If so, the response of the active probe of described forward logic is sent to remote equipment by described local device;

If not, negative logic process is carried out in the active probe response of described local device to described forward logic, obtains the active probe response of negative logic, the response of the active probe of described negative logic is sent to remote equipment.

2. the method for claim 1, is characterized in that, negative logic process is carried out in the active probe response of described local device to described forward logic, obtains the active probe response of negative logic, specifically comprises:

Respond as S in the active probe of described forward logic _i, and S _iduring ∈ S, negative logic process is carried out in the active probe response of described local device to described forward logic, and the active probe response of the negative logic obtained is specially: except S in S _ioutside random free position; Wherein, S={S ₁, S ₂, S ₃..., S _n, and described S is the real responsive state of active probe response correspondence, and i ∈ 1,2,3 ..., n}.

3. a treatment facility for active probe response, it is characterized in that, this equipment specifically comprises:

Acquisition module, for after receiving the active probe request from remote equipment, obtains the IP address of described remote equipment, and obtains the active probe response of forward logic corresponding to described active probe request;

Judge module, for judging whether described IP address is positioned at IP address inter-trust domain scope;

Processing module, during for being no when judged result, carrying out negative logic process to the active probe response of described forward logic, obtaining the active probe response of negative logic;

Sending module, during for being no when judged result, sends to described remote equipment by the response of the active probe of described negative logic; When judged result is for being, the response of the active probe of described forward logic is sent to described remote equipment.

4. equipment as claimed in claim 3, is characterized in that,

Described processing module is S specifically for the active probe response in described forward logic _i, and S _iduring ∈ S, carry out negative logic process to the active probe response of described forward logic, the active probe response of the negative logic obtained is specially: except S in S _ioutside random free position; Wherein, S={S ₁, S ₂, S ₃..., S _n, and described S is the real responsive state of active probe response correspondence, and i ∈ 1,2,3 ..., n}.

5. a processing method for active probe response, it is characterized in that, the method comprises the following steps:

Local device is after receiving the active probe request from remote equipment, obtain the IP address of described remote equipment, and obtain the active probe response of forward logic corresponding to described active probe request, and the active probe response of described IP address and described forward logic is sent to credible determination module;

Described credible determination module judges whether described IP address is positioned at IP address inter-trust domain scope; If so, the active probe response of the believable information in described IP address and described forward logic is sent to described local device by described credible determination module, by described local device, the response of the active probe of described forward logic is sent to described remote equipment; If not, the active probe response of the incredible information in described IP address and described forward logic is sent to negative logic system NLS processing module by described credible determination module;

Negative logic process is carried out in the active probe response of described NLS processing module to described forward logic, obtain the active probe response of negative logic, and the response of the active probe of described negative logic is sent to described local device, by described local device, the active probe of described negative logic is responded described in transmission to remote equipment.

6. method as claimed in claim 5, is characterized in that, negative logic process is carried out in the active probe response of described NLS processing module to described forward logic, obtains the active probe response of negative logic, comprising:

Respond as S in the active probe of described forward logic _i, and S _iduring ∈ S, negative logic process is carried out in the active probe response of described NLS processing module to described forward logic, and the active probe response of the negative logic obtained is specially: except S in S _ioutside random free position; Wherein, S={S ₁, S ₂, S ₃..., S _n, and described S is the real responsive state of active probe response correspondence, and i ∈ 1,2,3 ..., n}.

7. method as claimed in claim 5, is characterized in that, negative logic process is carried out in the active probe response of described NLS processing module to described forward logic, obtains the active probe response of negative logic, comprising:

Described NLS processing module determines the active probe response being input as described forward logic of this NLS processing module, after negative logic process is carried out to the active probe response of described forward logic, the output obtained is other active probe response outside the active probe response of described forward logic, and other active probe outside the response of the active probe of described forward logic responds as the active probe of negative logic responds.

8. a treatment system for active probe response, it is characterized in that, this system specifically comprises:

Local device, for after receiving the active probe request from remote equipment, obtain the IP address of described remote equipment, and obtain the active probe response of forward logic corresponding to described active probe request, and the active probe response of described IP address and described forward logic is sent to credible determination module;

Credible determination module, for judging whether described IP address is positioned at IP address inter-trust domain scope; If so, then the active probe response of the believable information in described IP address and described forward logic is sent to described local device, by described local device, the response of the active probe of described forward logic is sent to described remote equipment; If not, then the active probe response of the incredible information in described IP address and described forward logic is sent to negative logic system NLS processing module;

NLS processing module, for carrying out negative logic process to the active probe response of described forward logic, obtain the active probe response of negative logic, and the response of the active probe of described negative logic is sent to described local device, by described local device, the active probe of described negative logic is responded described in transmission to remote equipment.

9. system as claimed in claim 8, is characterized in that,

Described NLS processing module is S specifically for the active probe response in forward logic _i, and S _iduring ∈ S, carry out negative logic process to the active probe response of described forward logic, the active probe response of the negative logic obtained is specially: except S in S _ioutside random free position; Wherein, S={S ₁, S ₂, S ₃..., S _n, and described S is the real responsive state of active probe response correspondence, and i ∈ 1,2,3 ..., n}.

10. system as claimed in claim 8, is characterized in that,

Described NLS processing module, specifically for determining the active probe response being input as described forward logic of this NLS processing module, after negative logic process is carried out to the active probe response of described forward logic, the output obtained is other active probe response outside the active probe response of described forward logic, and other active probe outside the response of the active probe of described forward logic responds as the active probe of negative logic responds.